İçeriğe atla
Noroxi

laravel kayıtları

laravel üreticisine ait 29 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
3 · %10,3
Silahlaştırılmış
4 · %13,8
Pre-auth RCE
7
Düzeltme kaydı olan
%75,9
Yayından KEV’e ortanca
979 gün

Yıllara göre kayıt

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

29 kayıt
  • CVE-2021-3129
    99Hemen

    Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of i

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    laravel · laravel12 Oca 2021

  • CVE-2025-54068
    95Hemen

    Livewire vulnerable to remote command execution during property update hydration

    KritikCVSS 9,2KEVSilahlaştırılmışEPSS %97

    laravel · livewire17 Tem 2025

  • CVE-2018-15133
    85Hemen

    In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a pote

    YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %77

    laravel · laravel9 Ağu 2018

  • CVE-2017-16894
    56Planlayın

    In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct re

    YüksekCVSS 7,5SilahlaştırılmışEPSS %87

    laravel · laravel19 Kas 2017

  • CVE-2024-52301
    47Planlayın

    Laravel allows environment manipulation via query string

    YüksekCVSS 8,7Kavram kanıtıEPSS %45

    laravel · framework12 Kas 2024

  • CVE-2021-43617
    45Planlayın

    Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/Val

    KritikCVSS 9,8Kavram kanıtıEPSS %20

    laravel · framework14 Kas 2021

  • CVE-2024-55661
    43Planlayın

    Laravel Pulse Allows Remote Code Execution via Unprotected Query Method

    YüksekCVSS 8,7Kavram kanıtıEPSS %30

    laravel · pulse13 Ara 2024

  • CVE-2021-28254
    39İzleyin

    A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands.

    KritikCVSS 9,8İstismar yokEPSS %1

    laravel · laravel18 Nis 2023

  • CVE-2026-23524
    39İzleyin

    Laravel Redis Horizontal Scaling Insecure Deserialization

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    laravel · reverb21 Oca 2026

  • CVE-2022-2870
    39İzleyin

    laravel deserialization

    KritikCVSS 9,8İstismar yokEPSS %1

    laravel · laravel17 Ağu 2022

  • CVE-2020-19316
    36İzleyin

    OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.

    YüksekCVSS 8,8İstismar yokEPSS %3

    laravel · framework20 Ara 2021

  • CVE-2018-6330
    35İzleyin

    Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters.

    YüksekCVSS 8,8İstismar yokEPSS %2

    laravel · framework28 Mar 2019

  • CVE-2022-2886
    35İzleyin

    Laravel deserialization

    YüksekCVSS 8,8İstismar yokEPSS %1

    laravel · laravel19 Ağu 2022

  • CVE-2024-22859
    35İzleyin

    Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken fu

    YüksekCVSS 8,8İstismar yokEPSS %0

    laravel · livewire1 Şub 2024

  • CVE-2022-25838
    32İzleyin

    Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.

    YüksekCVSS 8,1İstismar yokEPSS %1

    laravel · fortify24 Şub 2022

  • CVE-2020-24940
    30İzleyin

    An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2.

    YüksekCVSS 7,5İstismar yokEPSS %1

    laravel · laravel3 Eyl 2020

  • CVE-2020-24941
    30İzleyin

    An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0.

    YüksekCVSS 7,5İstismar yokEPSS %1

    laravel · laravel3 Eyl 2020

  • CVE-2024-47823
    30İzleyin

    Livewire Remote Code Execution (RCE) on File Uploads

    YüksekCVSS 7,7Kavram kanıtıEPSS %1

    laravel · livewire8 Eki 2024

  • CVE-2026-39976
    28İzleyin

    Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens

    YüksekCVSS 7,1İstismar yokEPSS %0

    laravel · passport9 Nis 2026

  • CVE-2025-27515
    27İzleyin

    Laravel has a File Validation Bypass

    OrtaCVSS 6,9Kavram kanıtıEPSS %1

    laravel · framework5 Mar 2025

  • CVE-2017-9303
    24İzleyin

    Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers

    OrtaCVSS 6,1İstismar yokEPSS %1

    laravel · laravel29 May 2017

  • CVE-2021-43808
    24İzleyin

    Blade `@parent` Exploitation Leading To Possible XSS in Laravel

    OrtaCVSS 6,1İstismar yokEPSS %1

    laravel · framework7 Ara 2021

  • CVE-2024-13918
    24İzleyin

    Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page

    OrtaCVSS 6,1İstismar yokEPSS %1

    laravel · framework10 Mar 2025

  • CVE-2024-13919
    24İzleyin

    Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page

    OrtaCVSS 6,1İstismar yokEPSS %1

    laravel · framework10 Mar 2025

  • CVE-2024-21504
    24İzleyin

    Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] fo

    OrtaCVSS 6,1İstismar yokEPSS %1

    laravel · livewire19 Mar 2024